Abandoned WordPress Plugins With Active User Bases: 387 Potential Acquisition Targets

Most Installed: Top 10

1. 01

   CMB2

   786d inactive

   Justin Sternberg · 300K active installs · ★ 5.0

   300K sites are still running this plugin despite no updates for 786 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

2. 02

   Limit Login Attempts

   1,150d inactive

   Automattic · 300K active installs · ★ 4.6

   300K sites are still running this plugin despite no updates for 1,150 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

3. 03

   Adminimize

   804d inactive

   WP Media · 200K active installs · ★ 4.7

   200K sites are still running this plugin despite no updates for 804 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

4. 04

   Layout Grid Block

   1,052d inactive

   Automattic · 200K active installs · ★ 4.7

   200K sites are still running this plugin despite no updates for 1,052 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

5. 05

   PHP Compatibility Checker

   896d inactive

   WP Engine · 200K active installs · ★ 2.7

   200K sites are still running this plugin despite no updates for 896 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

6. 06

   AddQuicktag

   1,834d inactive

   Frank Bueltge · 100K active installs · ★ 4.7

   100K sites are still running this plugin despite no updates for 1,834 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

7. 07

   Easy Google Fonts

   1,770d inactive

   Sunny Johal · 100K active installs · ★ 4.6

   100K sites are still running this plugin despite no updates for 1,770 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

8. 08

   WooSidebars

   785d inactive

   WooThemes · 100K active installs · ★ 3.9

   100K sites are still running this plugin despite no updates for 785 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

9. 09

   WP Downgrade

   1,116d inactive

   Reisetiger · 100K active installs · ★ 4.8

   100K sites are still running this plugin despite no updates for 1,116 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

10. 10

    BackUpWordPress

    764d inactive

    Tom Willmot · 90K active installs · ★ 4.7

    BackUpWordPress does exactly what the name says: it schedules automatic backups of WordPress files and databases, then stores those archives locally or pushes them to remote destinations like Dropbox. The appeal is simplicity. Site owners who lack server access or technical confidence can set it up in minutes, and 90,000 sites currently rely on it to produce their only recoverable copy of business data. If BackUpWordPress stops functioning correctly, those sites lose their backup pipeline entirely. A silent failure, where the plugin appears to run but produces incomplete or corrupted archives, is the most dangerous outcome because the owner discovers the problem only after a breach or server failure when a restore is already needed.

    At 737 days without an update, BackUpWordPress sits in uncomfortable territory for a plugin that reads from and writes to the filesystem. The most relevant attack vectors here are arbitrary file read and path traversal. Because the plugin generates zip archives of the entire installation and exposes download links for those archives, a privilege escalation or authentication bypass vulnerability could allow an attacker to download a complete copy of the site, including wp-config.php, exposing database credentials and secret keys. A disclosed CVE in this category would essentially hand an attacker the keys to every connected service on that install.

    The acquisition case for BackUpWordPress is real but not simple. The backup category on WordPress.org has strong competitors like UpdraftPlus, which is actively maintained and holds far more installs. That competition limits how many of the 90,000 current users would stay after a migration notice. Still, the install count is large, the rating is 4.7/5, and backup plugins carry high user stickiness because switching requires trust. The answer is a cautious yes for a buyer who can commit to genuine security audits, not just cosmetic updates. Interested developers can typically reach the author through the plugin support forum on WordPress.org.